@ancient-wolf-19325 how do I configure

pyflyte

or

flytectl

to use Client Credentials for authenticating to an IdP such as Okta?

To configure pyflyte or flytectl to use the OAuth2 Client Credentials flow for authenticating to an IdP like Okta, set the

authType

(or

auth_mode

) to

client_credentials

(or `basic`/`clientSecret`) in your Flyte config. You must also provide the

client_id

and

client_secret

(or a reference to it via file or environment variable), and optionally specify scopes and audience as required by your IdP. Example config:

admin:
  endpoint: dns:///your-flyte-endpoint
  authType: client_credentials
  clientId: <your-client-id>
  clientSecret: <your-client-secret>
  # Or use clientSecretLocation or clientSecretEnvVar for better security
  scopes:
    - all
    - offline_access
  # audience: <your-audience>  # if required by your IdP

This setup allows headless authentication suitable for CI/CD and service accounts. For more details on these config options, see the code comments in flytekit/configuration/internal.py and the discussion in Flyte Issue #5021. Would you like a step-by-step breakdown or example for a specific IdP? Sources: - flytekit/configuration/internal.py - Flyte Issue #5021 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 when using the internal authorization server, do I need to add a new

staticClient

entry in the flyte helm chart values?

Yes, when using Flyte's internal authorization server, you must add a new

staticClient

entry for each client (such as pyflyte, flytectl, or flytepropeller) that needs to authenticate. This is done in the Helm chart values under the

auth.internal

section, specifying the

clientId

,

clientSecret

, and

clientSecretHash

as needed. This ensures the internal auth server recognizes and authorizes your client applications. See flyteadmin/auth/config/config.go and flyte-binary/templates/config-secret.yaml for details. Would you like a step-by-step example of how to add a new static client? Sources: - flyteadmin/auth/config/config.go - flyte-binary/templates/config-secret.yaml 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 should I use the clientId provided by my IdP server?

If you are using an external IdP (like Okta or Keycloak), you must use the

clientId

provided by your IdP for the relevant application registration. If you are using Flyte's internal authorization server, you define the

clientId

yourself in the

staticClients

section. This distinction is confirmed in flyteadmin/auth/config/config.go. Would you like more detail on how to register or configure the clientId for your specific setup? Sources: - flyteadmin/auth/config/config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 provide detail on how to register the clientId for my setup

Certainly! Here’s a step-by-step guide for registering the

clientId

depending on whether you use Flyte’s internal authorization server or an external IdP (like Okta or Keycloak): 1. Using Flyte’s Internal Authorization Server: - In your Flyte Helm chart values (e.g.,

values.yaml

), under the

auth

section, define a new static client by specifying a unique

clientId

and

clientSecret

. - Example:

auth:
    enabled: true
    enableAuthServer: true
    internal:
      clientId: my-client
      clientSecret: my-secret
      clientSecretHash: <bcrypt-hash-of-my-secret>

- The

clientId

and

clientSecret

can be any value you choose, but must match what your client (e.g., pyflyte or flytectl) uses to authenticate. - If you want to add multiple clients, you may need to extend the static clients list in the FlyteAdmin config. In the raw config, this is under

SelfAuthServer.StaticClients

(see flyteadmin/auth/config/config.go). In Helm, this is typically mapped via the

internal

section. 2. Using an External IdP (Okta, Keycloak, etc.): - Register a new application/client in your IdP’s admin console. - The IdP will provide a

clientId

and

clientSecret

for your application. - In your Flyte Helm chart values, set the

clientId

and

clientSecret

under the appropriate section (e.g.,

auth.oidc.clientId

and

auth.oidc.clientSecret

). - Example:

auth:
    enabled: true
    oidc:
      baseUrl: https://<your-idp-domain>/...
      clientId: <client-id-from-idp>
      clientSecret: <client-secret-from-idp>

- Use the same

clientId

and

clientSecret

in your client configuration (e.g., in

~/.flyte/config.yaml

for pyflyte/flytectl). General Notes: - For security, avoid hardcoding secrets; use Kubernetes secrets or environment variables where possible. - If using the internal server, you may need to generate a bcrypt hash of your secret for the

clientSecretHash

field. References: - flyteadmin/auth/config/config.go - flyte-binary/values.yaml Let me know if you need a concrete example for a specific IdP or Flyte deployment mode! Sources: - flyte-binary/values.yaml - flyteadmin/auth/config/config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what should I use

redirect_uris

for the static client I define?

It seems likely that for a static client in Flyte's internal authorization server, you should set

redirect_urls

to the callback URI your client (e.g., pyflyte, flytectl) will use after authentication. For CLI tools, this is typically

http://localhost:53593/callback

, which matches the default in Flyte's config and documentation. See flyteadmin/auth/config/config.go and flyteadmin/auth/auth_context_test.go for examples. Would you like more detail or examples for web-based clients or multiple redirect URIs? Sources: - flyteadmin/auth/config/config.go - flyteadmin/auth/auth_context_test.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what should I set the value of

public

to? true or false?

It seems likely that you should set

public: true

for clients that do not use a client secret (such as CLI tools or browser-based apps), and

public: false

for confidential clients that authenticate with a client secret (such as backend services). This distinction is shown in flyteadmin/auth/config/config.go, where static clients like

flytectl

are marked as public, while

flytepropeller

is not. Would you like more detail on when to use each setting? Sources: - flyteadmin/auth/config/config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 how do I get my cli tool to open a web browser for authenticating to my idp instead of using the links browser of the terminal?

By default, Flyte CLI tools (like flytectl and pyflyte) attempt to open your system's default web browser for authentication. If running in a headless environment or if the browser cannot be opened, the CLI will print the authentication URL to the terminal for manual use. There is no explicit config to force a specific browser, but you can ensure a GUI browser is available and set as default on your system. If you want to copy the URL and open it in your preferred browser, simply use the printed link. See Flyte Issue #638f31fe for discussion. Would you like more detail on customizing browser behavior or troubleshooting browser launch issues? Sources: - Flyte Issue #638f31fe 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 what are the default static clients in the internal authorization server used for? There are the following static clients defined:

flyte-cli

,

flytectl

The default static clients

flyte-cli

and

flytectl

in Flyte's internal authorization server are pre-configured to allow authentication for Flyte's command-line tools.

flyte-cli

and

flytectl

are used by users to interact with the Flyte backend for tasks such as workflow registration, execution, and management. These static clients enable the CLI tools to perform OAuth2 authentication flows (like PKCE or client credentials) against the internal auth server, ensuring secure access. See flyteadmin/auth/config/config.go for their definitions and usage. Would you like more detail on how these static clients are configured or how to add your own? Sources: - flyteadmin/auth/config/config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

@ancient-wolf-19325 how would you use client credentials with the

flyte-cli

and

pyfly

static clients. I don't see any credentials for them and they are marked as public? Can they only be used with PKCE?

It seems likely that the default static clients

flyte-cli

and

pyfly

are marked as public and do not have associated client secrets, which means they are intended for use with PKCE (browser-based) authentication flows, not the client credentials flow. The client credentials flow requires confidential clients (with

public: false

) and a client secret. Therefore, you cannot use the client credentials flow with these public static clients; you would need to define a new confidential static client (with a client secret) for that purpose. This is reflected in flyteadmin/auth/config/config.go. Would you like a step-by-step example of how to define a confidential static client for client credentials? Sources: - flyteadmin/auth/config/config.go 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.